 
 (defn- lookup-user-id
   "Lookup email -> Keycloak user-id, via cached Keycloak API."
-  [connection-manager req-opts api-root user-id-cache email]
+  [req-opts api-root user-id-cache email]
   (if-some [user-id (get-user-id user-id-cache email)]
     user-id
     (let [url (format "%s/users/?email=%s" api-root email)]
-      (let [users (-> (client/get url (assoc req-opts :connection-manager connection-manager)) :body json/decode)]
+      (let [users (-> (client/get url req-opts) :body json/decode)]
         (when-some [user-id (active-user users email)]
           (-> user-id-cache
               (swap! assoc email user-id)

   (let [params (merge {:grant_type "client_credentials"}
                       credentials)
         resp (client/post (get openid-config "token_endpoint")
                           {:form-params params})
         access-token (-> resp :body json/decode (get "access_token"))]
     {"Authorization" (str "bearer " access-token)
      "Content-Type" "application/json"}))
  ([{:keys [openid-config credentials connection-manager]}
    {:keys [timeout] :as req-opts}]
   (let [params (merge {:grant_type "client_credentials"}

  ([{:keys [api-root http-timeout user-id-cache connection-manager] :as keycloak} email
    {:keys [timeout] :or {timeout http-timeout}}]
   (let [bare-req-opts {:timeout timeout}]
     (when-let [headers (request-headers keycloak bare-req-opts)]
       (let [req-opts (assoc bare-req-opts :headers headers :connection-manager connection-manager)]
         (when-let [user-id (lookup-user-id req-opts api-root user-id-cache email)]
           (->> (client/get (format "%s/users/%s/groups" api-root user-id) req-opts )
                :body
                json/decode
                (reduce (fn [paths {:strs [path]}]
                          (conj paths (subs path 12)))
                        #{}))))))))


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
